Caught in the System, Ex-Hacker Is Stalked by His Past
wired.com
wired.com
Watt’s attorney told Wired in 2010 that his client accepted 'responsibility for aiding people that he knew would commit wrongdoing. However, he is very disturbed by the government’s aggressive attempt to make him into more than what he is.'"
The article spends a page and a half making you think that he's just some innocent guy who wrote a program for a friend who ended up using it maliciously, when in reality he admitted that he helped Gonzales who he knew was going to use it to commit crimes.
This is open and shut aiding and abetting a felony. And not some vague made-up felony. A felony that actually deserves to be a felony. Without taking any affirmative measures when he found out to turn his friend in, and without cooperating with police when he was charged with helping in the scheme. Is it the mark of an innocent person to you that when he found out his software had been used to commit a crime, even then he didn't help the police? The judge did absolutely the right thing in not giving him probation in order to send a signal.
---
While I tend to agree about overzealous prosecutions when it comes to computer crimes, let's not pretend that there aren't individuals being hurt by some of these crimes. I am a bit fuzzy on the exact nature of the fraud, but I get the impression that it was either small businesses or individuals that were hit. Dealing with fraudulent charges is neither easy nor stress free, even when it is clearly the case that fraud occurred. Sure, most eventually get it resolved, but as someone who has had to navigate those bureaucracies before I know how unpleasant it is.
This is not to say that business owners facing high stress and uncertainty about their financial future is sufficient justification for the magnitude of the punishment, but it isn't always just the major corporation that suffers.
No one is saying the guys isn't responsible, but how responsible, that's what matters.
The law, for obvious reasons, defines your guilt in aiding and abetting cases based on the seriousness of the underlying crime and your knowledge of the nature of that crime. Helping some guy break into a 7/11 knowing he intends to steal beer is a lot less serious of a crime than doing the same exact action knowing he intends to kill the cashier.
Do I have a responsibility to turn these people in? I know some/many/most of the users are grey/black hats. I might even have a notion of who those people are.
---
Let's flip the argument a wee bit. Say you're working for a weapons contractor building simulators and other tools for drones & ICBMs. You have a pretty good idea that your work is being used for death and destruction. You see some videos on the evening news of some people getting killed by a drone you helped build. Do you bear responsibility for the use of that drone?
Because I see the answer to both to be about the same.
> You see some videos on the evening news of some people getting killed by a drone you helped build. Do you bear responsibility for the use of that drone?
Of course you do. You created a tool that you knew not only had the potential to kill people, but would be in fact used to kill people. But it's not a crime because it's not a crime to kill people in war.
There is knowing with all its degrees but also there is 'should have known.' I suspect that he knew what his pals were up to and that's good enough.
1) The prosecutors had IRC logs found on his computer that suggest he knew in general terms what Gonzales was doing with his packet sniffer, and was receiving links from Gonzales about his break-ins; 2) Watts admitted that he knew Gonzales was doing something wrong.
If he genuinely had no idea what his software would have been used for that would be a totally different case.
Anyone whose worked in high end technical computing will have faced this and you have to decide at the time if you are cool with that.
For example at my first job I had to anlyse data from one of our test rigs and I commented to the guy I shared an office with that that looks like a REDACTED and his comment yeah probably REDACTED the Upgrade for the REDACTED weapon system - the one the then PM hadn't told the Cabinet about for a long time.
I had to sit down and think how I felt about this and if I was happy working on this sort of thing.
There is a reason why we do not charge Soldiers with murder when we tell them to go fight for us. It is the same reason we don't charge weapon makers for the deeds there weapons/tools are used for. In the first case, the responsibility lies with the people who elected that government that gave the order. Not the Soldiers following legal/moral orders. In the second the same applies, the tool maker can not be responsible for the actions of the tool user, that falls on the tool user no where else.
In the case of the person in the article, he just got screwed over by the government, by lawyers shifting the personal responsibility to the tool maker instead of the tool user.
But Watt refused to cooperate with authorities to help make their case against Gonzalez — aside from the fact that he was resolved not to snitch, he also maintained that he had no specific knowledge of his friend’s hacking scheme. His defiance may have been what did him in"
Sounds like a tool maker to me.
"Watt says he didn’t know the code would be used to intercept credit card data. 'I assumed it would have something to do with web traffic or instant messaging conversations or logins of some other protocol not related to the credit card information,' he told Wired in 2010.
Prosecutors disputed this and maintained that chat logs recovered from Gonzalez’s computer described illegal carding activity that Gonzalez conducted and showed that Watt at least had broad knowledge of what Gonzalez was doing, if not the details. As Gonzalez and his gang hacked target after target, he sent Watt links to news stories describing the breaches, though he didn’t acknowledge in the correspondence that he was behind the attacks.
Watt’s attorney told Wired in 2010 that his client accepted 'responsibility for aiding people that he knew would commit wrongdoing. However, he is very disturbed by the government’s aggressive attempt to make him into more than what he is.'"
It sounds like the jury didn't believe his story, particularly given the IRC logs and the links from Gonzalez describing the hacks. I can't say it's an unreasonable conclusion on their part.
You have a friend who is into lockpicking. Hey, that's a perfectly legal hobby as long as you're picking your own locks.
You have a Dremel tool and a grinding wheel, so he asks you to make him some custom picks. You don't know initially what these things will be used for, and you intentionally don't ask him what they're for. As it turns out, they're built for breaking into a specific make of lock that is only used on government installations. So, there is no way that it's just a hobbyist thing.
Your buddy then goes and steals government secrets with your custom picks so that he can sell them to China. He then sends you links to news stories talking about the thefts. You know that he's doing the crimes, but you say nothing. And when the police come by and ask you if you made the picks, you lie and pretend that you don't know anything.
Do you deserve the same sentence as him? No. But I'd say that you deserve prison time.
Right here you're screwed, regardless of the rest. Making false statement to a government agent is a crime of itself, regardless what this statement is about. You could say "I'm not talking to you" or "Fifth amendment, to the rescue!" but if you lie, they can knit a nice prison sentence out of it.
Well so far, accused computer criminals have a lot more credibility than Stephen Heymann. Whats with taking anything that guy says at face value?
> I can't say it's an unreasonable conclusion on their part.
To be fair, you can't say it's a reasonable one either, unless you've also seen the logs.
Usually the winner gets to decide how strong a defense following orders is.
Oh, granted, other people are responsible too - perhaps even more responsible than you. However, responsibility isn't an exclusive property, two or more people can be jointly responsible.
Maybe he thought (or was told) that this would "show remorse" and that he'd get a lighter sentence than otherwise.
The lesson here to take away from this is to encrypt your stuff and if you're doing some kind of criminal activity to make (or force) your associates do the same.
Also you seem to be in complete agreement that the prosecutors got it right on this one, as it seems sure you would agree that they got it right on the Aaron Swartz case.
We all know that the government gets it completely right on these cases, right? /sarcasm
If it was just the program, it would be a whole separate matter. But as much as the article wants you to think that, if you read the whole second page, you can see that the evidence the jury had in front of them painted a different picture.
As for being punished for the rest of his life--the government didn't do that. The government punished him for two years, for aiding in a crime that resulted in tens of millions of dollars in fraud. The fact that people don't want a guy like that working for them after serving his time is somewhat unfair, but also pretty understandable.
*) The article makes "not snitching on your friends" out to be some noble thing, but it's not and that's not how civilized societies work. If this were guys at Enron and not hackers, Wired would never be so sympathetic to that kind of bullshit.
Being a snitch is reprehensible. He was more than reasonable.
I don't think anyone here is saying there should have been no punishment or consequences, but do you seriously think his sentence is proportional to his crime?
When I read the background information on Watts missing from the article but mentioned here on HN, turns out he was an experienced security researcher with strong indications at being blackhat and at least having great knowledge in blackhat activities and manufacturing blackhat tools himself, and being proud of it. That's a bit different picture than the original article is painting.
Bad things don't happen to good people, and good people don't do bad things or associate with bad people.
If someone gets arrested or convicted for doing something bad, then you associating with them must mean that either (1) you are also a bad person, or (2) bad things do in fact happen to good people, and could happen to you.
This would suggest that a way to fix things would be to publicize that the system has a disturbingly high error rate (bad things do in fact happen to good people) and the damage from that needs to be reduced. Another way would be to get rid of the belief that (getting caught) doing one bad thing makes you forever a bad person, but that would require working against how intolerance seems to feed on itself...
Evidence please . . . what a one-dimensional statement. It turns out life isn't binary.
I HAVE to say this after what I've seen in my life. (I've spent a significant portion of it researching cancer.)
Bad things DO HAPPEN to good people.
I really can't believe people can actually go through life and think this is a remotely reasonable statement. I'm not sure there are many statements in existence that I could disagree with more strongly...
He is the same person who goes by the name of 'the unix terrorist' and was pretty active in the hacking world: http://www.phrack.com/issues.html?issue=65&id=2
Would the judge, probation board, or whoever is in charge be ok with something like bitcoin? It is pretty linked in the popular mind with criminal doings.
Would any bitcoin exchange be OK with their development potentially being monitored by the government?
I think both of these are pretty likely answered in the negative.
And, sadly (in my opinion), it appears they succeeded.
He should've been happy making $130k a year in 2007